added XSS protection